Poll remote hosts for metrics from a central Metricbeat installation

Elastic Stack Beats
1

Hi,
Does (or will) Metricbeat support polling remote hosts like routers,switches,etc. for metrics from a central server (where Metricbeat would be installed)? The reason for this is most routers and switches do not provide a way to install any software on them.

Regards,
Rahul Swaminathan

2

It doesn't, but it sounds like a great module to create.

Alternatively, you can use https://www.elastic.co/guide/en/logstash/current/plugins-inputs-http_poller.html

3

Thanks @warkolm!

I'll open up a feature request on the github page. Below are the initial ideas that I think that the feature can have. Please feel free to add/modify/delete.

  1. Input:
    • List of hosts to poll for metrics with options as:
      - Hostname, Connection method, Command/MIB/RPC, Cron timing, Additional tags to add before shipping to Elasticsearch/Logstash
  2. Connection method:
    • SSH
    • SNMP
    • NETCONF (Future...)
  3. Output:
    • Standard Metricbeat output that can be pushed to Elasticsearch directly or Logstash for parsing

Regards,
Rahul Swaminathan

4

@rahulswaminathan Question from my side is why you would not want to do this with Logstash instead of Metricbeat? In general it is recommended to install Metricbeat on the edge node to only have to access localhost. In case you want to fetch your Metrics from a centralised server there are lots of plugins available for Logstash already.

Perhaps you can elaborate what would be advantage of using Metricbeat in your case over Logstash?

5

Hey @ruflin,
Like the http_poller mentioned above, are there plugins to query remote hosts using SSH or SNMP? I checked the Logstash Input Plugins page but couldn't find any. If you do find it, please let me know. If it doesn't exist currently, I can then take this up with the Logstash folks and raise a feature request.
My intention to do this using Metricbeat was to keep the ship, parse and store model consistent with the BELK stack. But, it doesn't matter which software we use as long as the data gets collected.

Thanks for your input!

Regards,
Rahul Swaminathan

6

Just did some quick Googeling: https://www.elastic.co/guide/en/logstash/current/plugins-inputs-snmptrap.html I'm sure the LS guys can tell you better if there are some more plugins.

In case it doesn't exist, here is a dev guide on how to create a plugin: https://www.elastic.co/guide/en/logstash/current/_how_to_write_a_logstash_input_plugin.html

And here you can find the Dev guide for Metricbeat: https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-developer-guide.html

Probably in the end it also depends on your preferred language to create such a tool, as it is possible with both.

7

This topic was automatically closed after 21 days. New replies are no longer allowed.